Managing Windows Vista Volume Shadow Copies

The Windows Volume Shadow Copy Service (or VSS) might not seem that important if you’re working with XP or Windows Server 2003. But, Ed Tittel shows you how valuable it can be when getting down and dirty with Vista.

Like this article? We recommend

In working with Windows XP and Windows Server 2003, I’d
come across the Windows Volume Shadow Copy Service—which Microsoft
abbreviates as VSS for some reason or another—but it wasn’t until I
started getting down and dirty with Windows Vista that I truly began to
appreciate its capabilities and resource costs on modern Windows systems.

My VSS learning adventure started with a sudden realization that
close to 100GB of storage space had “gone missing” on a brand-new
750GB drive I’d just added to one of my systems. The impetus to learn came
from a screen inside the excellent Windows GPL-licensed disk space monitoring
utility known as WinDirStat,
which looked very much like what appears in Figure 1.

When I selected the Show Unknown option in WinDirStat, I was
suddenly confronted with a huge yellow block of file space whose origin and
contents are opaque to that program, but whose appetite for disk space was
clearly enormous. Further investigation led me to the following
observations:

These files all occurred in the hidden and protected System Volume Information directory.

Vista stubbornly refuses to allow any account, even the named Administrator account, to delete any of these files.

All these files are related to restore points, backups, and other arcane file system snapshots.

In Vista and Windows Server 2008, in fact, not even disk defragmentation software is allowed to touch or move these files. Where they go on a hard disk is where they must stay on that hard disk.

As it turns out, all of these files also belong to the Volume
Shadow Copy Service. In moving files over to my new drive, and in deciding to
consolidate all 83GB of my music files on that drive, I had inadvertently
created a situation where Windows Vista would happily consume a huge amount of
disk space for volume shadow copies of one kind or another.

Understanding the Windows Volume Shadow Copy Service

The MSDN Library contains more than 100 pages of documentation
on the Volume
Shadow Copy Service (a collection of documents interested readers are
advised to view using IE rather than other browsers, so as to be able to access
the interactive table of contents, as well as the document content). Ordinary
users don’t need to know anywhere near that much about VSS, however. For
them, the most salient information about VSS can be summarized in a handful of
bullet points as follows:

The primary job of the VSS is to create shadow copies of files and file systems. Shadow copies represent “point-in-time” snapshots of a file system, and enable backup programs and other software to copy their contents from a stable, unchanging information base, even when active use of open files is underway. This provides all kinds of useful benefits to Windows because it lets systems keep working even as their contents are being copied.

Shadow copies provide the foundations for Windows Restore Points and most forms of Windows backup (including the built-in NTbackup.exe program in Windows XP and Server 2003, and the Backup and Restore Center facilities in Vista and Server 2008). Stored shadow copies also permit all these versions of Windows to make previous versions of files available to users on demand.

By default, Windows allocates 15 percent of a disk drive or available free space for shadow copy storage, whichever amount is smaller. But unless users impose a hard ceiling on this allocation, this number can get even bigger. My putative 750GB disk drive (decimal numbers) is actually only 698GB in measurable size (a binary gigabyte or 230 is really more like 1.074GB in decimal); 30 percent of 698GB is a whopping 104.7GB. My missing 100GB was less than that number, but more space than I wanted to give up on that drive for shadow copies. Most of that 100GB, in fact, was locked up in one shadow copy of the 83GB’s worth of music files I copied there in a single go!

As shadow copy storage space gets occupied, older shadow copies are purged to make room for new ones. Windows estimates the amount of space needed for each new copy, then removes as many old copies as are needed to create that space. This often means that two or more old shadow copies get purged to create room for a new shadow copy. By default, Windows Vista automatically creates one new restore point every day.

Windows Vista and Server 2008 provide a command-line utility for managing shadow copies, and for controlling the volume shadow copy service. It’s called vssadmin. Users can also manage volume shadow copy behavior by disabling, then re-enabling, shadow copies in the Control Panel System Properties item (Start, Control Panel [Classic View], System, Advanced System Settings, System Protection tab; turn off all check boxes in the Available Disks pane, then click Apply to kill all existing shadow copies, then click all drives on which you want shadow copies kept). I don’t recommend this, however, unless you can stomach the idea that all existing shadow copies get destroyed in this process. I won’t do it myself, nor should you, unless you can live without the backup and protection that those shadow copies provide.